Yes I never trusted it fully, and I would strongly suggest anyone to run it in a VM or at least a container, where it doesn't have access to your credentials, browser cookies and sensitive files. It's very irresponsible otherwise.

Example: around 1 year ago the bot made a small coding mistake and created a '~' folder. I asked it to delete it (not in auto mode) and of course it went with a very nice "rm -rf ~" (which of course I denied).

Modern models are much smarter, but I would not trust the auto classifier to stop everything dangerous and make a similar hallucination slip through.